The Ministry of Electronics and Information Technology has published ‘The Digital Personal Data Protection Bill 2022’.
Provisions of new bill
- The bill narrows down the scope of the data protection regime to personal data protection, leaving out non-personal data from its ambit.
- The new Bill provides for significant concessions on cross-border data flows. It proposes that the Central government will notify countries or territories outside India to which a Data Fiduciary may transfer personal data.
- The bill has introduced the concept of ‘Consent Managers’. It is not always possible to keep track of the instances in which one has given consent to the processing of personal data. A consent manager platform will enable an individual to have a comprehensive view of her interactions with Data Fiduciaries and the consent given to them.
- The Bill requires the consent of the individual to be the basis for processing of their personal data, except in certain circumstances where seeking the consent of the Data Principal is “impracticable or inadvisable due to pressing concerns”.
- The Data Principal shall have the right to withdraw her consent at any time.
- The Bill also gives the power to the government to offer exemption from its provisions “in the interests of sovereignty and integrity of India” and to maintain public order.
- A new regulatory body ‘Data Protection Board’ to be set up by the government. The board can impose a penalty of up to Rs 500 crore if non-compliance by a person is found to be significant.
- The Bill proposes six types of penalties for non-compliance, including up to Rs 250 crore for failure to take reasonable security safeguards, up to Rs 200 crore for failure to notify the Board and affected users in the event of a personal data breach, and up to Rs 200 crore for non-fulfilment of additional obligations related to children.
Background
- The first draft of the Bill was presented by an expert panel headed by Justice B.N. Srikrishna in July 2018, after a year-long consultation process.
- That draft was revised, and a final Bill was tabled in Parliament in December 2019.
- It was soon referred to a joint parliamentary committee, which submitted its report in December 2021.
- The Ministry of Electronics and IT withdrew the Bill from Parliament this August 2022, and stated that a new bill would be presented, which fit into the “comprehensive legal framework”.
